Control of risk: obligations of persons conducting businesses or undertakings